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Top Stories 

• Virginia Express commuter trains, Metro, and Amtrak trains running along the Northeast 
corridor were delayed or forced to run on a reduced schedule February 20 due to issues 
triggered by cold temperatures. - Associated Press; WJLA 7 Washington, D.C. (See item 3) 

• Classes were canceled across schools in the district February 20 after 400 students had 
their feet and shoes decontaminated at Winnemucca Junior High School in Nevada after a 
student took a salt shaker filled with mercury to school. - Reno Gazette- Journal (See item 

14) 

• At least 15 inmates at Ironwood State Prison in California were injured following a riot 
February 13 that began when about 120 inmates began fighting in a dining hall. - Palo 
Verde Valley Times/Quartzsite Times (See item 1^) 

• Illinois officials announced that Baldwin Fake reopened February 19 following a 15-day 
closure that was initiated after about 100,000 gallons of untreated wastewater spilled into 
the reservoir. - Belleview News-Democrat (See item 25) 
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Energy Sector 



Nothing to report 
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Chemical Industry Sector 

Nothing to report 
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Nuclear Reactors, Materials, and Waste Sector 

1 . February 20, CapeCod.com - (Massachusetts) Pilgrim Nuclear Power Station in 
Plymouth now online. An Entergy spokesperson at Pilgrim Nuclear Power Station in 
Plymouth announced that the station was back online and reconnected to the grid 
February 18 after being shut down as a precaution to avoid a repeat of an unplanned 
shutdown in January. Officials are unsure of when the station will reach 100 percent 
power. 

Source: http://www.capecod.com/newscenter/pilgrim-nuclear-power-station-plymouth- 
now-online/ 
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Critical Manufacturing Sector 

Nothing to report 
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Defense Industrial Base Sector 

Nothing to report 
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Financial Seryices Sector 

2. February 20, Softpedia - (National) Tax related spear-phishing aims at CTOs in 
tech companies. Security researchers at Talos discovered a new phishing campaign 
targeting chief technology officers (CTOs) with malicious attachments disguised as 
Microsoft Word documents laced with macros that funnel in the Vawtrak banking 
trojan, which can capture user credentials for more than 100 online services. The emails 
purport to be related to large sum payment details and federal taxes, with some 
appearing to originate from fake government addresses. 

Source: http://news.softpedia.eom/news/Tax-Related-Spear-Phishing-Aims-At-CTOs- 
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In-Tech-Companies-473772.shtml 
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Transportation Systems Sector 

3. February 20, Associated Press; WJLA 7 Washington, D.C. - (National) Bitter cold 
causes cracked rails, more major delays on Metro, Amtrak, VRE. Virginia Express 
commuter trains, Metro, and Amtrak trains running along the Northeast corridor 
including Virginia and Washington, D.C., were delayed or forced to run on a reduced 
schedule February 20 after cracked rails and switch issues that were triggered by cold 
temperatures. 

Source: http://www.wila.eom/articles/2015/02/another-dav-of-extremelv-cold-weather- 
causes-metro-amtrak-delays-1 1 1622.html 

4. February 19, Alaska Dispatch News - (Alaska) DOT says weather likely caused 
rockslide that closed Seward Highway. The Alaska Department of Transportation 
and Public Facilities (DOT) reported that a rockslide that struck an SUV and closed a 
portion of the Seward Highway for 2 hours February 19 was caused by alternately 
freezing and thawing weather. DOT crews removed serval large boulders and debris 
from the roadway and continue to monitor the area. 

Source: http://www.adn.eom/article/20150219/dot-savs-weather-likelv-caused- 
rockslide-closed-seward-highway 
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Food and Agriculture Sector 

5. February 20, Evansville Courier & Press - (Illinois) Fire destroys southern Illinois 
ag plant. An office and a large warehouse at the Crop Production Services agricultural 
plant in Browns, Illinois, were damaged by a fire that broke out February 20 and 
remains under investigation. Frigid temperatures and strong winds hampered the 
firefighters’ response to the blaze. 

Source: http://www.courierpress.com/news/local-news/southem-illinois/fire-destrovs- 
southern-illinois-ag-plant 42330529 

6. February 19, Yuma Sun - (Arizona) Arizona citrus quarantine expands to Maricopa 
County. A State-imposed Asian citrus psyllid quarantine was expanded to include 
Maricopa County after the insects were detected in several residential areas around Gila 
Bend. The Arizona Department of Agriculture urged the public to abstain from taking 
citms fruit, plants, or cuttings from the area inside the quarantine that bans citms from 
being sent outside the affected area without certification to do so. 

Source: http://www.vumasun.com/news/arizona-citms-quarantine-expands-to- 
maricopa-county/article e66b663c-b894-l Ie4-9218-23447488cac9.html 

7. February 19, U.S. Department of Agriculture - (Ohio; Illinois; North Carolina) 

Kenosha Beef International recalls beef product due to possible Listeria 
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contamination. The Food Safety and Inspection Service announced February 19 that 
Ohio-based Kenosha Beef International recalled about 21,427 pounds of Fully Cooked 
Black Angus Ground Beefsteak (chopped and formed) due to possible contamination 
with Listeria monocytogenes. The affected product was produced January 24 and 
packaged in 35.3-pound boxes that were shipped to distributors in Illinois and North 
Carolina. 

Source: http://www.fsis.usda.gov/wps/portal/fsis/topics/recalls-and-public-health- 
alerts/recall-case-archive/archive/20 1 5/recall-034-20 1 5-release 



8. February 19, U.S. Food and Drug Administration - (New York) Kirsch Mushroom 
Co. Inc. recalls Chilean Mushrooms for undeclared sulfites. The U.S. Food and 
Drug Administration reported February 18 that Kirsch Mushroom Co. Inc., recalled its 
Chilean Mushrooms that were sold at Sloan super markets in Buffalo between 
November-December 2014 due to undeclared sulfites. The recall was initiated after 
routine sampling by the New York State Department of Agriculture and market food 
inspectors and subsequent analysis revealed a sulfite level in excess of 10 milligrams 
per serving. 

Source: http://www.fda.gov/Safetv/Recalls/ucm43501Q.htm 

9. February 19, U.S. Food and Drug Administration - (New York; New Jersey; Virginia) 
Chocolate By Design Inc. issues allergy alert on undeclared egg in Milk Chocolate 
Assorted Character Icing Pops, Christmas Icing Pops and Triple Heart Icing 
Pops. The U.S. Food and Drug Administration reported February 18 that Chocolate By 
Design Inc., issued a recall for Assorted Character, Christmas, and Triple Heart 
varieties of its Milk Chocolate Icing Pops due to undeclared egg. Production of the 
Icing Pops products was suspended until the labeling has been corrected. 

Source: http://www.fda.gov/Safetv/Recalls/ucm434934.htm 
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Water and Wastewater Systems Sector 

10. February 19, WCTI 12 New Bern - (North Carolina) Much of Martin County under 
boil order. A boil water advisory was issued to about 1,000 Martin County Water 
District 1 customers in North Carolina February 19 after a water main burst and caused 
a loss of pressure that allowed for contaminants to leak in. Officials were collecting 
samples for bacteria testing to ensure water safety, and reported that the advisory could 
be lifted by February 21 when the results of the tests are returned. 

Source: http://www.wctil2.com/news/much-of-martin-county-under-boil- 
order/3 1363954 



For another story, see item 25 
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Healthcare and Public Health Sector 



11. February 20, Evansville Courier & Press - (Indiana) Flooding closes Gateway urgent 
care clinic until Monday. The urgent care facility on Deaconess Hospital’s Gateway 
campus in Newburgh will remain closed at least through February 23 due to flooding 
inside the building, officials announced February 20. 

Source: http://www.courierpress.com/news/local-news/fIooding-closes-gatewav- 
urgent-care-clinic-until-monday 66365375 

12. February 20, Orlando Business Journal - (Florida) 3 arrested for operating 
unlicensed Orlando clinic for insurance fraud. The Florida Department of Financial 
Services announced February 19 that three individuals were arrested for allegedly 
operating an unlicensed clinic in Orlando as part of a personal injury protection fraud 
scam. A doctor charged in the scheme fronted ownership of the Unity Pain & Injury 
Center LLC from February-December 2012, while the clinic was actually run by non- 
licensed individuals who paid the doctor $1,500 a month for use of his name. 

Source: http://www.bizjournals.com/orlando/morning call/20 15/02/3-arrested-for- 
operating-unlicensed-orlando-clinic.html 

13. February 19, Boston Globe - (Massachusetts) Gas-fed fire forces evacuation of 
Duxbury care facility. Seventeen residents from the Duxbury House, an Alzheimer’s 
care center in Massachusetts, were evacuated and temporarily relocated to an adjacent 
building following a 2-alarm fire and gas leak February 19. Damage estimates totaled 
$500,000 after a snapped pipe caused the gas leak which led to the ignition of the gas 
by a furnace in the basement. 

Source: http://www.bostonglobe.eom/metro/2015/02/19/alarm-fire-forces-evacuation- 
alzheimer-care-facilitv-duxburv/gPLRVCSbXpHUlavFSHnKVO/story.html 
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Government Facilities Sector 

14. February 20, Reno Gazette -Journal - (Nevada) School canceled in Winnemucca 
after mercury scare. Classes were canceled across schools in the district February 20 
after 400 students had their feet and shoes decontaminated on the football field of 
Winnemucca Junior High School in Nevada after a student took a salt shaker filled with 
mercury to the school February 19 leaving trails of it through the hallways and on the 
school bus. Three other schools in the area were placed under a precautionary 
lockdown to ensure the mercury did not travel to other schools. 

Source: http://www.rgi.eom/storv/news/2015/02/19/mercurv-spill-prompts-lockdown- 
winnemucca- school/237 01433/ 

15. February 20, Aurora Beacon-News - (Illinois) Ten Boulder Hill students sent to a 
hospital after school bus crash. An accident near Orchard Road and Caterpillar Drive 
in Illinois involving a vehicle and a school bus transporting Boulder Hill Elementary 
School students caused 10 students to be transported to an area hospital for evaluation 
February 20. 



-5 - 



Source: http://www.chicagotribune.com/suburbs/aurora-beacon-news/news/ct-abn- 
oswego-bus-crash-st-0222-20150220-story.html 

16. February 19, Wilmington News Journal - (Delaware) School bus crash sends 16 
students to hospital. Sixteen students were injured in an accident involving 3 school 
buses in Bridgeville, Delaware, February 19. One bus crashed into a second bus, 
forcing it to collide with a third bus. 

Source: http://www.delawareonline.eom/storv/news/crime/2015/02/19/school-bus- 
crash-sends-students-hospital/237 10003/ 

17. February 19, KTLA 5 Los Angeles - (California) White powder sent to L.A. County 
judge possibly linked to series of such letters: FBI. Officials cleared the scene 
February 19 at the Stanley Mosk Courthouse in Los Angeles 3 hours after a letter 
containing an unknown white substance was sent to a judge, prompting a HAZMAT 
response. The incident is being investigated by the FBI after reports of other letters 
containing white powder that were sent to government buildings February 18-19. 
Source: http://ktla.eom/2015/02/19/hazmat-team-sent-to-stanlev-mosk-courthouse-in- 
downtown-l-a-over-suspicious-letter/ 

1 Return to top i 

Emergency Services Sector 

18. February 19, Palo Verde Valley Times/Quartzsite Times - (California) Another prison 
riot at Ironwood. At least 15 inmates at Ironwood State Prison in Blythe, California, 
were injured following a riot February 13 when about 120 inmates began fighting in the 
D yard dining hall. Prison staff deployed several less lethal force options in an attempt 
to quell the disturbance including OC pepper spray, blast dispersion grenades, and 
expandable batons. 

Source: 

http://paloverdevalleytimes .com/main.asp?SectionID= 1 &SubSectionID= 1 &ArticleID= 
21103 
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Information Technology Sector 

19. February 20, Softpedia - (International) Commercial spyware found in enterprise 
environment. Security researchers at Lacoon Mobile Security and Check Point 
discovered 18 different commercial remote access trojan (mRAT) spying tools that 
connect to the company’s Wi Fi and communicate with the command and control 
(C&C) server on 1,000 of 900,000 corporate mobile devices tested. The spyware, 
generally marketed for monitoring children, allows employers to track the location of 
users, log activity on the device, access emails, texts, and contacts, and possibly 
activate the device’s microphone for recording. 

Source: http://news.softpedia.com/news/Commercial-Spvware-Found-in-Enterprise- 
Environment-473785.shtml 
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20. February 20, The Register - (International) Hackers now popping Cisco VPN 
portals. An Australian hacker reported a flaw that allows attackers to crack customized 
Cisco virtual private networks (VPNs) to steal credentials, inject malware, modify 
Clientless Secure Sockets Layer (SSL) and VPN portal content, and launch cross-site 
scripting (XSS). Cisco stated that the flaw was due to improper implementation of 
authentication checks in the customization framework of Clientless SSL VPN portal 
versions earlier than October 8, 2014 and recommended customers follow their incident 
response process. 

Source: 

http://www.theregister.co.uk/2015/02/20/hackers popping cisco vpn portals/ 

21. February 19, Softpedia - (International) Android malware takes over device’s 
shutdown process. AVG security researchers discovered a new mobile malware strain 
affecting Android devices that hijacks the shutdown process and obtains root 
permission to run nefarious activities such as initiating calls or taking pictures while the 
phone appears to be off. 

Source: http://news.softpedia.com/news/Android-Malware-Takes-Over-Device-s- 
Shutdown-Process-473705.shtml 



For another story, see item 2 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: http://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

22. February 19, WSAZ 3 Huntington - (West Virginia) Frontier continues to work on 
damaged cables near train derailment. Frontier Communications technicians 
continued to work with railroad and public safety officials February 19 to replace fiber- 
optic cables that were damaged by a train derailment in Fayette County during the 
week of February 16. A representative reported that broadband service was restored 
February 18 but voice-service was still down while additional repairs were being made. 
Source: http://www.wsaz.com/news/headlines/Frontier-Continues-to-Work-on- 
Damaged-Cables-near-Train-Derailment-292736621.html 

For additional stories, see items 2 and 21 
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Commercial Facilities Sector 



23. February 20, Reuters - (California) Bomb scare proves false alarm near Hollywood 
venue for Oscars. A bomb scare triggered by an erratic motorist brandishing a propane 
tank and nitrous oxide prompted a 5-hour closure of a hotel and storefronts in a 
Hollywood shopping strip February 19 while a bomb squad investigated and cleared 
the scene. The incident that was rendered a false alarm occurred in the area of the 
Dolby Theatre complex where an upcoming awards ceremony is scheduled to take 
place February 22 and traffic was previously closed off in preparation for the high 
profile event. 

Source: http://www.msn.com/en-us/news/us/bomb-scare-proves-false-alarm-near- 
hollvwood-venue-for-oscars/ar-BBhLD9X 

24. February 20, Foster’s Daily Democrat - (New Hampshire) Threat of roof collapse 
closes stores Crossings at Fox Run. At least 4 stores at the Crossings at Fox Run mall 
were evacuated and closed February 19 after a cracked steel support beam and sagging 
ceilings were observed inside a business. Crews were on the scene to remove snow 
from the roofs of the mall that must remain closed until structural engineers approve 
the building’s safety. 

Source: 

http://www. fosters. com/apps/pbcs.dll/article?AID=/20150220/GJNEWS 01/15022998 
1/0/SEARCH 



Eor another story, see item 2 
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Dams Sector 



25. February 19, Belleville News-Democrat - (Illinois) Two weeks after sewage spill, 
Baldwin Lake reopens. The Illinois Department of Natural Resources announced that 
Baldwin Eake in the Kaskaskia River State Eish and Wildlife Area reopened Eebruary 
19 following a 15-day closure that was initiated after about 100,000 gallons of 
untreated wastewater spilled into the reservoir. A fractured air release valve was 
replaced and water samples showed the lake is safe for public recreation. 

Source: http://www.bnd.eom/2015/02/19/3670419 two-weeks-after-sewage-spill- 
baldwin.html 
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NTAS 



NO ACTIVE ALERTS 
wwvv.DHS.gov /alerts 



Department of Homeland Security (DHS) 

DHS Daily Open Source Infrastructure Report Contact Information 



About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday through Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailvReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support® govdeliverv.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert. gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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